Identifying DGA Malware via Behavior Analysis

Zang, Xiaodong; Gong, Jian; Zong, Ping

doi:10.1109/wcnc49053.2021.9417570

Cited by 2 publications

(2 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Despite the fact that many detection approaches based on DNS traffic have been proposed in the previous decade, difficulties and risks continue to emerge. [34] presented a unique behavior-based DGA-based botnet detection scheme at the upper DNS hierarchy. The number of flows in each period of time, the access interval, the number of peer IPs in each period of time, and the number of application types are used to characterise, model, and evaluate four focused traffic behaviours: rhythmic behaviour, cyclical behaviour, community behaviour, and service diversity behaviour.…”

Section: Literature Surveymentioning

confidence: 99%

See 1 more Smart Citation

A Deep learning framework for domain generation algorithm based malware detection

Abhiram

Anver

Rahiman³

2023

Preprint

View full text Add to dashboard Cite

Command and control server, also known as C2 or C&C related cyberat-tacks have sharply grown in recent years. Attackers typically use a domain generating algorithm (DGA) to generate domain names in a random fashion for their C&C servers automatically. As a result, a thorough investigation into the identification of DGA domains has been conducted. On the other side, a lot of anti-malware programmes rely on network whitelisting, hashing, or static string verification. These strategies are fundamental for usage with those risky malware attacks, which can conceal their existence and employ various techniques to evade detection. A two-level model makes up the suggested deep learning framework. First, features from the domain names are generated using a feature generator. Next, DGA domains are distinguished from other domain types, and last, the clustering phase is utilised to pinpoint the type of those DGA domains. This paper demonstrates how the suggested system can efficiently extract the attributes from the domain names, as well as group, categorise, and detect harmful domains with more precision. When compared to other models, the proposed model performs better.

show abstract

Section: Literature Surveymentioning

confidence: 99%

“…Only analyze the character string behaviour [20] Word graph method This model takes longer computational time in large scale networks. [34] Behavior analysis The process is long time taking one.…”

Section: Data Collectionmentioning

confidence: 99%